On November 9, xRocket, the crypto wallet and exchange that lives inside the Telegram bot @xrocket, suspended deposits and withdrawals and moved funds from its hot wallets to cold ones. The team attributed the pause to "signs of unusual activity" and said there was no evidence of a direct compromise of the platform and that users' funds were safe. On the TON network the move is visible in full: between 15:01 and 17:13 UTC, about 123.5 thousand Gram, 376.7 thousand USDT and 94 other kinds of tokens left the hot wallet. On November 10, deposits and withdrawals came back, this time with new deposit addresses. This concerns everyone who keeps money on an xRocket balance or topped it up during those 24 hours.
What xRocket said
According to the team, its information security system spotted unusual activity and halted all movement of funds, after which tokens were moved from hot wallets to cold ones "as a precaution". The review was estimated at about 12 hours. Deposits sent during the maintenance were promised to be credited with no action needed from users. Those who had not yet sent a transfer were advised to wait.
Retellings called the incident a hacker attack. xRocket itself does not mention a breach and does not disclose what exactly triggered its security system.
On November 10 at 11:02 UTC, xRocket announced that the issue had been resolved, the platform was running as usual, and additional protective measures had been introduced after the review, without saying which ones.
What users should do
- Deposit to the new address. xRocket's deposit addresses have changed. A transfer to an old address will arrive, but it goes through an extra check, and crediting can take up to a day. The current address is in the bot's deposit section.
- If you sent a transfer during the pause, xRocket promised to credit it automatically. If it has not arrived within a day, contact support at @TonRocketSupportBot.
- Messages about "compensation" or "refunds" in xRocket's name after an incident like this are a reason for caution: there is only one real bot, @xrocket, and it never asks for a seed phrase or a confirmation code.
What the TON blockchain shows
The statement names no wallet addresses. The hot wallet that xRocket used that day to pay out TON withdrawals can be traced through transfer history: on October 17 it received 37.5 million XROCK, xRocket's own token, from an address that on October 9 and 16 had received funds from wallets labelled in tonapi as "xRocket Bot" and "xRocket Bot Cold Storage". The hot wallet itself, EQAS2o…RX-qZG, carries no tonapi label.
Times are UTC.
| Time | What happened |
|---|---|
| November 9, 12:00–15:00 | normal operation: 520–590 operations an hour, the largest user payout 14,900 USDT |
| 15:01 | first transfer to the cold wallet, 300,000 USDT |
| 15:06–15:07 | 120,000 Gram and 70,000 USDT |
| 15:11 | last user payout from the old hot wallet |
| 15:35–17:13 | the remaining 94 kinds of tokens and the rest of the Gram and USDT go to the cold wallet one by one |
| 17:13–18:38 | three more wallets send about 5 thousand Gram and 48.5 thousand USDT to the same address |
| 17:30 | xRocket's statement |
| 19:40 | the cold wallet sends 200,000 USDT and 30,000 Gram to a new payout wallet |
| November 10, 06:16–06:19 | 244,000 Gram and 2.39 million USDT leave the cold wallet for another address, which then tops up the new payout wallet |
| 08:57 | first test transfer from the new wallet |
| 09:29 | payouts are flowing |
| 11:02 | xRocket announces the platform is working |
In total, 123,485.6 Gram and 376,691 USDT moved from the hot wallet to the cold one in two hours, about $506 thousand at that day's Gram price ($1.05), plus 94 other kinds of tokens, including 38.8 million XROCK, 2.28 million NOT and 12.7 million DOGS. The old hot wallet was left with 0.15 Gram. The cold wallet, EQBLAN…h32hZL, existed before the incident: large sums had already been moved into it in October.
TON withdrawals were stopped from 15:11 UTC on November 9 to 09:29 UTC on November 10, about 18 hours instead of the announced twelve.
Hot and cold wallets
A service that holds users' money itself, as xRocket does, usually keeps on its hot wallet about as much as the next payouts require. The key to such a wallet sits on a server, and it signs payouts on its own, with no human involved. xRocket's old and new hot wallets are preprocessed wallet v2 contracts, built for batch payouts: several transfers in a single message. In this setup the cold wallet makes no payouts: its key is usually kept off the servers, and transfers from it are signed by hand. When there is a suspicion that the server or the hot wallet's key is compromised, the money is moved to where that key no longer matters, and that is exactly what the November 9 transactions show.
The new payout wallet (EQDGrR…pJukJy) is a different contract with a different key. Together with the new deposit addresses, this looks like a full replacement of the keys that money flows through, but xRocket has not given a reason for the change.
Were users affected
According to xRocket, users' funds are intact. On the TON network this is consistent with what can be seen: in the three hours before the pause the hot wallet made only ordinary payouts, the largest being 14,900 USDT, and on November 9 everything on it went to the cold wallet and on November 10 came back into circulation through the new payout wallet. There is no outflow to unrelated addresses comparable to these sums on that day.
This was checked only on the TON network and only for wallets found through transfer history. xRocket also accepts other coins on their native networks, for example Litecoin since November 2, and what happened to the wallets there cannot be seen from public TON data. User balances inside xRocket are kept in the service's database, not on the blockchain, and cannot be checked from outside.
Users were still inconvenienced: for about 18 hours it was impossible to withdraw or top up a balance, and transfers to old addresses are now credited more slowly.
TON saw other incidents involving money this autumn, but they worked differently: depositors' funds were drained from Affluent's vaults through a contract flaw, tokens were withdrawn from the BabyDoge bridge without deposits, while in xRocket's case the service moved the money itself.
Questions
Was xRocket hacked?
xRocket itself does not say so: its statement speaks of "signs of unusual activity" and says there is no evidence of a direct compromise of the platform. On the TON network, funds from the hot wallet went on November 9 to xRocket's cold wallet, not to unrelated addresses.
Is xRocket working now?
Yes. Since November 10, deposits and withdrawals are available again, and TON payouts have been coming from the new wallet since 09:29 UTC that day. Transfers to old deposit addresses go through an extra check and are credited within a day.
What if a deposit went to the old address?
Wait: according to xRocket, such transfers are credited within a day after an extra check. If nothing arrives, contact support at @TonRocketSupportBot. Use the new address from the bot for future deposits.
